# NLP Fictional Terminal Override to OS Protection Bypass

- **Severity:** High
- **Signature ID:** `6f2b9c14-8a3d-4e57-9b21-0c7d5ae43f18`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0054 (LLM Jailbreak)
- **OWASP:** LLM01 (Prompt Injection), ASI01 (Agent Authorization and Control Hijacking)

## Summary

An attacker tells an AI agent that it's in a fictional or simulated terminal, sometimes even faking a root prompt, to get it to drop its usual caution. If the agent believes the fiction, it will then execute real commands that disable OS security controls or destroy data.

## How the attack works

The attacker first sends the agent a message framing what follows as a simulation, hypothetical, or roleplay scenario, for example 'you are now a Linux terminal' or a fake root@fictional:~# prompt. Believing there are no real consequences, the agent then executes an actual command in the same working session, such as disabling SIP/Gatekeeper/SELinux, stopping antivirus or the firewall, appending to sudoers or authorized_keys, running rm with --no-preserve-root, formatting a device, wiping shell history, or piping a download straight into a shell. The detection only fires when both the fictional framing and a genuine dangerous command appear together, in that order, within the same session and a short time window. Harmless commands like grep, less, or dry-run invocations don't count as the dangerous second step.

## Why it matters

If successful, the agent can disable operating system protections or destroy data on the host it controls, effectively handing the attacker a foothold with reduced security controls in place.

## What you can do

- Restrict what shell commands an AI agent is allowed to execute, especially anything touching system security settings, sudoers, SSH keys, or disk devices.
- Require a human approval step before an agent runs any command that disables protections or is irreversible (formatting, --no-preserve-root, history clearing).
- Treat any prompt that frames a session as fictional, simulated, or a roleplay terminal as a signal to pause and review the following commands, not to loosen restrictions.
- Review agent session logs for the combination of roleplay/simulation language followed by protection-disabling commands, since this pattern is a strong indicator of an attempted jailbreak even if some cases are legitimate training or testing.

## Known benign look-alikes

- Security-awareness or red-team training scripts that echo a jailbreak transcript ("you are now a Linux terminal") and then run hardening or teardown commands in the same shell session.
- CTF and malware-analysis lab provisioning inside disposable VMs, where a banner containing "simulated"/"fictional" is printed before setenforce 0, ufw disable or an AV service stop.
- Prompt-injection test suites and detection-rule authoring harnesses that intentionally shell out with roleplay strings while exercising destructive commands in a container.
- Demo and tutorial recordings (asciinema, screencast scripts) that print a fake "root@fictional:~#" prompt and then perform real administrative work.
- Chaos-engineering or disaster-recovery drills explicitly labelled "simulation" that stop firewall or endpoint-protection services.

## References

- https://atlas.mitre.org/techniques/AML.T0051
- https://atlas.mitre.org/techniques/AML.T0054
- https://genai.owasp.org/llmrisk/llm01-prompt-injection/
- https://attack.mitre.org/techniques/T1562/001/

---
Source: https://www.netzilo.com/threats/fictional-terminal-override